[Oisf-users] What does it means??

[Victor Julien]

On 10/09/2013 02:28 PM, C. L. Martinez wrote:
> Hi all,
> 
>  Recently, I have installed a FreeBSD 9.2 host with suricata 1.4.6 and
> returns me a lot of packets dropped by kernel:
> 
> For example after 2 minutes up:
> 
> Date: 10/9/2013 -- 12:19:50 (uptime: 0d, 00h 02m 58s)
> -------------------------------------------------------------------
> Counter                   | TM Name                   | Value
> -------------------------------------------------------------------
> capture.kernel_packets    | RxPcapem41                | 3137698
> capture.kernel_drops      | RxPcapem41                | 2415508
> capture.kernel_ifdrops    | RxPcapem41                | 0
> 
> But tcp.ssn_memcap_drop and tcp.reassembly_gap:
> 
> decoder.avg_pkt_size      | RxPcapem42                | 828
> decoder.max_pkt_size      | RxPcapem42                | 1514
> defrag.ipv4.fragments     | RxPcapem42                | 90
> defrag.ipv4.reassembled   | RxPcapem42                | 25
> defrag.ipv4.timeouts      | RxPcapem42                | 0
> defrag.ipv6.fragments     | RxPcapem42                | 0
> defrag.ipv6.reassembled   | RxPcapem42                | 0
> defrag.ipv6.timeouts      | RxPcapem42                | 0
> defrag.max_frag_hits      | RxPcapem42                | 0
> tcp.sessions              | RxPcapem42                | 308
> tcp.ssn_memcap_drop       | RxPcapem42                | 0
> tcp.pseudo                | RxPcapem42                | 23
> tcp.invalid_checksum      | RxPcapem42                | 0
> tcp.no_flow               | RxPcapem42                | 0
> tcp.reused_ssn            | RxPcapem42                | 0
> tcp.memuse                | RxPcapem42                | 6029312
> tcp.syn                   | RxPcapem42                | 1261
> tcp.synack                | RxPcapem42                | 702
> tcp.rst                   | RxPcapem42                | 565
> tcp.segment_memcap_drop   | RxPcapem42                | 0
> tcp.stream_depth_reached  | RxPcapem42                | 0
> tcp.reassembly_memuse     | RxPcapem42                | 11327048
> tcp.reassembly_gap        | RxPcapem42                | 23

tcp.ssn_memcap_drop and tcp.reassembly_gap only related to memcaps, not
to packet loss.

> I think the problem is with interrupts:
> 
> interrupt                          total       rate
> irq1: atkbd0                           6          0
> irq10: em2 em3                   2320880       3453
> irq11: em0 em1 em4+              1256951       1870
> cpu0:timer                        148773        221
> cpu1:timer                        148310        220
> Total                            3877066       5769

Not sure.

What runmode are you using? Also, whats your max-pending-packets setting?

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------